ToolZeno

SSH Key Pair Viewer

Inspect, decode, and analyze SSH public and private keys (Ed25519, RSA, ECDSA, DSA) 100% locally in your browser. Calculate fingerprints and security ratings with zero server transmission.

100% Client-Side Privacy: All SSH key parsing and fingerprint generation is performed locally inside your browser. No key material or passwords are ever stored or uploaded.

1Load SSH Key

Try Sample Key:

No SSH Key Loaded

Upload a key file (.pub, .pem, .key, .txt) or paste your OpenSSH public or private key to instantly inspect its algorithm, bit size, and fingerprints.

What is an SSH Key Pair?

An SSH Key Pair consists of two cryptographically linked keys used by the Secure Shell (SSH) protocol to authenticate remote logins and secure server communication. SSH key authentication relies on public-key cryptography (asymmetric encryption), eliminating the security risks associated with traditional password-based authentication.

SSH Public Key (`id_ed25519.pub`)

The public key is shared freely and installed on target servers (typically appended to ~/.ssh/authorized_keys). Anyone with your public key can encrypt data that only your matching private key can decrypt.

  • Safe to share publicly and place on servers
  • Contains public parameters and optional user comment
  • Usually stored as a single-line ASCII text file

SSH Private Key (`id_ed25519`)

The private key must be kept strictly secret on your local computer. It signs authentication challenges issued by the server to prove your identity.

  • Never share or upload private keys
  • Should be protected by a strong passphrase
  • Formatted as OpenSSH or PEM block structure

Comparison of SSH Key Algorithms

Recommended

Ed25519

Twisted Edwards curve (256-bit). High speed, small signature size, constant-time execution resistant to side-channel attacks.

Recommended (4096)

RSA (2048/4096)

Widely compatible integer factorization algorithm. Use 4096-bit for long-term security; avoid < 2048-bit sizes.

Acceptable

ECDSA

NIST curves (P-256, P-384, P-521). Compact key size with standardized elliptic curve parameters.

Deprecated

DSA

Legacy 1024-bit Digital Signature Algorithm. Disabled by default in OpenSSH 7.0+. Should be replaced immediately.

SSH Key Fingerprints Explained

An SSH Fingerprint is a short cryptographic hash of the public key wire representation. When connecting to an SSH server for the first time, your SSH client displays the server’s host key fingerprint to prevent Man-in-the-Middle (MitM) attacks.

SHA-256 vs. MD5 Fingerprint Formats

SHA-256 (Default)

Base64 encoded 256-bit hash (e.g., SHA256:4/x...). Standard format used in modern OpenSSH versions.

MD5 (Legacy)

Hexadecimal 128-bit hash (e.g., MD5:c1:b2:...). Used in older legacy SSH systems.

SSH Key Management Best Practices

  • Use Ed25519 or RSA 4096 for new key generation.
  • Always set a strong passphrase on private keys (ssh-keygen -p).
  • Never store or upload private keys to unverified web servers or online repositories.
  • Regularly audit ~/.ssh/authorized_keys across all cloud servers.

Frequently Asked Questions

Yes, 100% safe! ToolZeno performs all parsing and fingerprint generation locally in your browser using pure JavaScript and Web Crypto APIs. Your key content is never sent over any network, saved in storage, or transmitted to any server. Moreover, this tool is strictly read-only and will never request passphrases for encrypted private keys.

ToolZeno supports all standard SSH key algorithms, including Ed25519, RSA (2048, 3072, 4096 bits), ECDSA (NIST P-256, P-384, P-521 curves), and legacy DSA (1024 bits). We also support OpenSSH single-line public keys, RFC 4716 format, OpenSSH binary private key headers, PKCS#1, and PKCS#8 PEM formats.

The SHA-256 fingerprint is computed by taking the binary wire representation of the public key (including the key type identifier and public parameters), hashing it with SHA-256 via Web Crypto API, and Base64-encoding the resulting 32-byte digest (formatted with a 'SHA256:' prefix).

DSA keys are limited to 1024-bit modulus length and are cryptographically vulnerable. Most modern SSH clients (such as OpenSSH 7.0+) have disabled DSA by default. RSA 1024-bit is also cryptographically obsolete. OpenSSH recommends using Ed25519 or RSA with at least 3072/4096-bit length.

No. This viewer is strictly read-only and explicitly designed for metadata inspection. It detects whether a private key is encrypted (and identifies the cipher/KDF metadata when available), but it does not process passphrases or decrypt key material, keeping your secrets completely secure.

Related Tools

Hash Generator

Compute MD5, SHA-1, SHA-256, and SHA-512 cryptographic checksums in-browser.

Open Tool

HMAC Generator

Generate Keyed-Hash Message Authentication Codes (HMAC) client-side for secure API authentication.

Open Tool

JWT Decoder

Decode JSON Web Tokens, parse payloads, and inspect cryptographic signatures client-side.

Open Tool

Secret Key Generator

Generate cryptographically secure secret keys, API tokens, JWT secrets, AES-256 keys, and HMAC signatures 100% client-side using Web Crypto API.

Open Tool